Loading malware…
Shai-Hulud is a credential-stealing, self-propagating supply-chain malware family associated with repeated attacks on software package ecosystems, especially npm. Recent variants and descendants, including the worm commonly tracked as ChainDrop and the Mini Shai-Hulud lineage, compromise legitimate package releases and execute during dependency installation through malicious lifecycle hooks. The malware typically uses a staged JavaScript infection chain, including a dropper that invokes a legitimate Bun runtime to launch a heavily obfuscated payload while preserving normal package functionality, allowing poisoned releases to appear operational.
Its primary objective is large-scale theft of developer, CI/CD, cloud, and repository credentials. Observed collection targets include npm publishing tokens, GitHub credentials, GitHub Actions and OIDC material, SSH keys, cloud provider credentials, Kubernetes and Vault secrets, Terraform and environment files, shell histories, and other developer workstation and build-runner secrets. Stolen data is compressed, encrypted, and exfiltrated through attacker-controlled infrastructure, with some variants using Ethereum smart-contract-based resolution and GitHub-based fallback channels to make command-and-control more resilient.
Shai-Hulud is notable for worm-like propagation. When it obtains npm publishing access, it can enumerate packages writable by the victim, inject malicious install-time hooks and payload files, increment package versions, and republish trojanized releases through normal registry channels. When it captures GitHub credentials or GitHub App tokens, it can modify repositories, implant execution hooks for developer tools such as VS Code and Claude Code, and abuse GitHub Actions workflows to harvest additional secrets. Some analyzed variants also contain targeted logic for abusing trusted publishing flows based on GitHub Actions OIDC, enabling malicious releases to retain valid provenance metadata.
The malware has been linked in reporting to TeamPCP and to code lineage published in 2026, but attribution for later campaigns remains unconfirmed because the source became available for reuse by other operators. Confirmed activity has targeted the JavaScript open-source ecosystem at scale, including widely used caching and utility libraries and packages maintained by unrelated publishers and organizations. The family represents a high-impact software supply-chain threat because a single maintainer or CI compromise can rapidly cascade into hundreds of trusted package releases and broad downstream credential exposure across developer workstations and build environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-10894 highlights how a single workflow misconfiguration can cascade into widespread compromise across the JavaScript ecosystem. The attack chain for CVE-2025-10894 began with exploitation of a GitHub Actions workflow in the Nx repository. The workflow used the pull_request_target trigger, which grants elevated permissions (including a writable GITHUB_TOKEN) to workflows running on pull requests from forks. Attackers crafted pull requests with titles containing bash injection payloads. | The campaign escalated with the release of a self-replicating worm (Shai-Hulud) that used harvested npm credentials to infect additional packages, resulting in over 500 compromised npm projects.
Shai-Hulud is a self-propagating, info-stealing malware that infects software components, uses the access to publish poisoned versions, and then harvests the repository accounts of those affected by the malware downstream.
359 GitHub repos created with encrypted stolen credentials — “Shai-Hulud: Here We Go Again.” CVE-2026-45321 published CVSS 9.6 critical. Mitre, CISA, and major registry operators issue coordinated advisories. | Shai-Hulud is, at this point, a very familiar name... The most recent one being the so-called Mini Shai-Hulud... they are back again... compromising the TanStack Router packages, and starting a brand new campaign based on Mini Shai-Hulud.
In the Shai-Hulud incident, the compromised packages (MAL-2025-46974 and CVE-2025-59144) were identified early, providing actionable findings that customers could remediate quickly.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Is This Shai-Hulud? Multiple indicators point to this being the Shai-Hulud toolchain documented by JFrog ... The ChainDrop worm is clearly part of the Shai-Hulud code lineage.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The group often uses a purpose-built, self-replicating npm worm it developed called Shai-Hulud to infect GitHub projects.
researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide.
A new wave of the Shai-Hulud supply chain campaign, adding 23 newly discovered malicious PyPI package-version artifacts to an already alarming operation that previously compromised 37 packages.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Use stolen npm credentials to publish infected patch releases of every writable package. Use GitHub credentials and GitHub Actions to infect repositories and steal more credentials.
A new self-propagating malware strain called CHAINDROP has backdoored more than 400 packages after attackers compromised the maintainer of the widely used keyv library.
This initial foothold provides the ability to publish malicious packages, overwriting legitimate ones.
Inside a GitHub Actions run where GITHUB_WORKFLOW_REF contains release-drafter.yml and GITHUB_REPOSITORY contains /opensearch-js , it requests an Actions OIDC token with audience npm:registry.npmjs.org ... exchanges the OIDC token for a publish token, and publishes.
The attackers inserted a preinstall hook into package.json, a standard npm feature that runs commands before a package finishes installing.
Use stolen npm credentials to publish infected patch releases of every writable package. Use GitHub credentials and GitHub Actions to infect repositories and steal more credentials.
Adds .github/workflows/codeql_analysis.yml with commit message Add CodeQL Analysis , committed as github-advanced-security[bot] .
the malicious packages are setup to detonate immediately on installation... While many malicious packages embed their execution within the postinstall or similar hooks that trigger on installation, NPM also exposes hooks that trigger on publish, such as postpublish.
Use stolen npm credentials to publish infected patch releases of every writable package. Use GitHub credentials and GitHub Actions to infect repositories and steal more credentials.
Adds .github/workflows/codeql_analysis.yml with commit message Add CodeQL Analysis , committed as github-advanced-security[bot] .
the malicious packages are setup to detonate immediately on installation... While many malicious packages embed their execution within the postinstall or similar hooks that trigger on installation, NPM also exposes hooks that trigger on publish, such as postpublish.
The 727 KB payload was protected by three nested layers of obfuscation and encryption... Layer 1 used Base91 encoding... Layer 2 used a custom byte-permutation cipher built on PBKDF2-SHA256... Layer 3 used AES-256-GCM encryption plus gzip
Adds .github/workflows/codeql_analysis.yml with commit message Add CodeQL Analysis , committed as github-advanced-security[bot] .
Use stolen npm credentials to publish infected patch releases of every writable package. Use GitHub credentials and GitHub Actions to infect repositories and steal more credentials.
It is the maturing of a trend in which the software build pipeline, and the trust mechanisms meant to protect it, have become the attack surface.
The worm detaches when it is not in CI. If it detects a CI environment it runs inline in the job instead... One further gate runs before the worm engages in any collection. This gate is a locale check that, on a Russian-language host, prints “Exiting as russian language detected!” and exits cleanly.
On Linux GitHub Actions runners, it uses sudo python3 to read the Runner.Worker process memory through /proc/<pid>/mem and extracts secret-store objects marked isSecret:true .
The injected workflow is named Run Copilot and does one thing: assign ${{ toJSON(secrets) }} to an environment variable, write it to format-results.txt , and upload the file as an artifact. | When the collector finds an npm token, it validates the token before exfiltration even completes.
The filesystem collector reads hundreds of configured paths ... .env files, shell histories, SSH private keys, VPN profiles ... /proc/self/environ .
It resolves AWS credentials from environment, profiles, web-identity tokens, ECS metadata, and IMDSv2, then enumerates Secrets Manager and SSM Parameter Store (with WithDecryption: true ) across 17 regions.
CHAINDROP first collects credentials from developer systems, including npm, GitHub, cloud, Kubernetes, SSH, CI/CD, and AI coding-tool stores.
On Linux GitHub Actions runners, it uses sudo python3 to read the Runner.Worker process memory through /proc/<pid>/mem
The worm detaches when it is not in CI. If it detects a CI environment it runs inline in the job instead... One further gate runs before the worm engages in any collection. This gate is a locale check that, on a Russian-language host, prints “Exiting as russian language detected!” and exits cleanly.
250 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier self-replicating npm supply-chain worm referenced as background and comparison for the current CHAINDROP campaign; also described in related content as abusing developer credentials and npm publishing workflows to spread across packages.
Earlier npm supply-chain malware/campaign referenced for comparison; also associated in the article with GitHub repo propagation and stolen publishing credentials used to spread through trusted release channels.
Referenced as the code lineage/toolchain that ChainDrop appears to derive from; a published npm self-propagation and GitHub exfiltration toolkit reused or adapted in this campaign.
Named malware/campaign family referenced as the broader operation associated with the CHAINDROP npm supply-chain compromise. The payload contains Dune-themed references and similarities to previous Shai-Hulud campaigns.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.